Snort mailing list archives
Re: flex response and cisco span ports
From: Greg Herlein <gherlein () herlein com>
Date: Wed, 2 Jan 2002 10:19:19 -0800 (PST)
So I guess my question is this.. Can I make the sensor send it's flex-response packets out the 'mgmt' port instead? Surely there are other people with an environment like this [snort, cisco catalyst switches, flex-response] .. What's everyone else doing?
I suspect that you can fix this by making sure that your routing configuration is set so that packets are routed out the "management" interface. I'd configure that eth to be the default anyway, and have the second interface (eth1 or whatever) be the snort port. Then the response packets ought to go out as expected. I think. YRMV. Greg _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- flex response and cisco span ports tyler (Jan 02)
- Re: flex response and cisco span ports Greg Herlein (Jan 02)
- <Possible follow-ups>
- RE: flex response and cisco span ports Graeme Fowler (Jan 02)
- Re: flex response and cisco span ports Greg Robinson (Jan 02)
- Re: flex response and cisco span ports Rich Adamson (Jan 03)
- Re: flex response and cisco span ports John Roberds (Jan 02)
- Re: dual nic, was: flex response and cisco span ports Byron (Jan 02)
- Re: flex response and cisco span ports Greg Robinson (Jan 02)
- RE: flex response and cisco span ports tyler (Jan 02)
- RE: flex response and cisco span ports tyler (Jan 02)